{%- set etcdnode=[] -%}
{%- if groups['etcd'] is not defined %}
    {%- for host in groups['master'] -%}
        {{ etcdnode.append(host) }}
    {%- endfor%}
{%- else%}
    {%- for host in groups['etcd'] -%}
        {{ etcdnode.append(host) }}
    {%- endfor%}
{%- endif %}

[Unit]
Description=Kubernetes API Server
Documentation=https://github.com/kubernetes/kubernetes

[Service]
ExecStart=/usr/local/bin/kube-apiserver \
  --service-account-issuer=api \
  --api-audiences=api \
  --service-account-signing-key-file={{ kubernetes.ssl.location }}/ca.key \
  --authorization-mode={{ kubernetes.apiserver.authorization_modes | join(',') }} \
  --enable-admission-plugins={{ kubernetes.apiserver.enable_admission_plugins | join(',') }} \
  --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256 \
  --advertise-address={{ ansible_default_ipv4.address }} \
  --bind-address={{ kubernetes.apiserver.bind | default('0.0.0.0') }}  \
  --secure-port=6443 \
  --insecure-port=0 \
  --anonymous-auth=false \
  --allow-privileged=true \
  --audit-log-path=/var/log/audit.log \
  --audit-policy-file=/etc/kubernetes/audit-policy-minimal.yaml \
  --audit-log-format=json \
  --audit-log-maxage=30 \
  --audit-log-maxbackup=10 \
  --audit-log-maxsize=100 \
  --service-account-lookup=true \
  --storage-backend=etcd3 \
  --etcd-cafile={{ kubernetes.ssl.location }}/etcd/ca.crt \
  --etcd-certfile={{ kubernetes.ssl.location }}/apiserver-etcd-client.crt \
  --etcd-keyfile={{ kubernetes.ssl.location }}/apiserver-etcd-client.key \
  --etcd-servers={% for host in etcdnode %}https://{{ host }}:2379{% if not loop.last %},{% endif %}{% endfor %} \
  --event-ttl=1h \
  --experimental-encryption-provider-config=/etc/kubernetes/encryption-config.yaml \
  --enable-bootstrap-token-auth \
  --client-ca-file={{ kubernetes.ssl.location }}/ca.crt \
  --kubelet-https \
  --kubelet-client-certificate={{ kubernetes.ssl.location }}/apiserver-kubelet-client.crt \
  --kubelet-client-key={{ kubernetes.ssl.location }}/apiserver-kubelet-client.key \
  --kubelet-preferred-address-types={{ kubernetes.apiserver.kubelet_preferred_address_types | join(',') }} \
  --runtime-config=api/all=true \
  --service-cluster-ip-range={{ kubernetes.settings.SvcCIDR }} \
  --service-node-port-range={{ kubernetes.settings.NodePortRange }} \
  --service-account-key-file={{ kubernetes.ssl.location }}/ca.key \
  --tls-cert-file={{ kubernetes.ssl.location }}/apiserver.crt \
  --tls-private-key-file={{ kubernetes.ssl.location }}/apiserver.key \
  --requestheader-client-ca-file={{ kubernetes.ssl.location }}/ca.crt \
  --requestheader-username-headers=X-Remote-User \
  --requestheader-group-headers=X-Remote-Group \
  --requestheader-allowed-names=front-proxy-client \
  --requestheader-extra-headers-prefix=X-Remote-Extra- \
  --proxy-client-cert-file={{ kubernetes.ssl.location }}/front-proxy-client.crt \
  --proxy-client-key-file={{ kubernetes.ssl.location }}/front-proxy-client.key \
  --profiling=false \
{% if kubernetes.apiserver.log is defined %}
  --logtostderr=false \
  --log-dir={{ kubernetes.apiserver.log.logDir }} \
{% endif %}
  --v={{ kubernetes.apiserver.log.logLevel | default(2) }}

Restart=on-failure
RestartSec=5
LimitNOFILE=65536

[Install]
WantedBy=multi-user.target
